skills.rest
lNwNl
lNwNlCOMMUNITY
Explore all skills by this author →
GitHub

websocket-security

Detect WebSocket security weaknesses in handshake validation, session binding, and message semantics.

2|Updated May 15, 2026
Search Tags:#security testing#websocket#handshake#cswsh#origin validation#wss#message fuzzing
One-click install
npx skills add https://github.com/lNwNl/Methodos --skill websocket-security-lnwnl
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: websocket-security
Source: https://github.com/lNwNl/Methodos/tree/main/docker/opencode/skills/websocket-security
Command: npx skills add https://github.com/lNwNl/Methodos --skill websocket-security-lnwnl

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

WebSocket applications can be vulnerable during the upgrade handshake, session binding, and message handling, enabling cross-site WebSocket hijacking, injection, and transport-layer weaknesses.

Core Features & Use Cases

  • WebSocket handshake review: Verify required headers and interpret server 101 responses to confirm correct protocol negotiation.
  • CSWSH risk assessment: Check whether Origin validation is missing and whether cookie/session rules allow a victim to be impersonated.
  • Tooling and vulnerability coverage: Guide practical testing with wsrepl and ws-harness concepts, plus common flaws like token leakage in URLs, weak transport (ws://), rate limits, and message injection.
  • Execution decision framework: Use a stepwise decision tree to align WebSocket testing with related REST authentication/authorization boundaries.

Quick Start

Use websocket-security to validate the WebSocket handshake headers, test whether Origin is enforced for CSWSH resistance, and probe message handling for injection and authorization gaps on an authorized target.

Frequently Asked Questions about websocket-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for cross-site WebSocket hijacking (CSWSH) vulnerabilities?▼

To test for CSWSH, you verify whether the WebSocket handshake enforces Origin header validation and check if cookie or session rules allow victim impersonation. A missing Origin check combined with ambient cookie authentication confirms the vulnerability.

What security checks are needed for WebSocket handshake validation?▼

WebSocket handshake validation requires reviewing required headers, interpreting server 101 responses to confirm protocol negotiation, and verifying Origin enforcement to prevent cross-site WebSocket hijacking during the upgrade phase.

How do I assess WebSocket message handling for injection risks?▼

You assess WebSocket message injection by probing message semantics for authorization gaps and fuzzing payloads. This targets real-time endpoints used for chat, notifications, and streaming where browsers maintain persistent authenticated channels.

Does my WebSocket application need wss transport security?▼

Your WebSocket application needs wss transport security to prevent token leakage and protect persistent authenticated channels. Using weak ws:// transport exposes session tokens in URLs and leaves real-time endpoints vulnerable to interception.

What tools are used for WebSocket penetration testing?▼

WebSocket penetration testing uses tools like wsrepl and ws-harness concepts to interact with and manipulate WebSocket connections. These tools help test handshake headers, message injection, and rate limiting gaps on authorized targets.

Can I test WebSocket endpoints alongside REST authentication boundaries?▼

You can test WebSocket endpoints alongside REST authentication boundaries using a stepwise decision tree framework. This aligns WebSocket testing with related REST authorization checks to ensure consistent session binding and protocol review.

Related Skills

Explore More Software Engineering Skills→
ok-helloworldok-helloworld
241

websocket-security

Identify WebSocket handshake weaknesses, CSWSH conditions, and message-level vulnerabilities.

Community
Intermediate
langbyyilangbyyi
96

websocket-security

Detect WebSocket security vulnerabilities including CSWSH, missing authentication, and message injection.

Community
Intermediate
daemon-blockint-techdaemon-blockint-tech
7

web-pentester

Plan and conduct authorized OWASP Top 10 web and API security testing.

Community
Advanced
florianbuetowflorianbuetow
12

websocket

Audit WebSocket implementations for security vulnerabilities and message validation gaps.

Community
Advanced